fix: hydrate automation and clarify role trusts

[TacoRocket]

What changed

• hydrate Automation accounts with a per-account get so managed identity fields stay truthful when list results are thin
• fall back cleanly with an explicit issue when Automation account hydration is unreadable
• surface a short role-trusts detail row labeled "how control could widen" when AzureFox can show the visible transform clue
• document and test the new role-trusts help/output cues

Why

• the live Terraform lab showed Automation accounts reporting null identity fields even when the full account object had managed identity data
• role-trusts had transform details available in the model but not a short operator-facing cue in the default table

Validation

• python3 -m ruff check src/azurefox/collectors/provider.py src/azurefox/help.py src/azurefox/render/table.py tests/test_collectors.py tests/test_terminal_ux.py tests/test_help.py
• python3 -m pytest tests/test_collectors.py tests/test_terminal_ux.py tests/test_help.py tests/test_cli_smoke.py -k "collect_automation or hydrates_identity_from_account_get or falls_back_when_account_get_fails or collect_auth_policies or automation_table_mode or auth_policies_partial_read or collect_role_trusts or role_trusts or help_command_role_trusts_topic or role_trusts_full_mode or chains_deployment_path_json or chains_deployment_path_table_output"
• guarded pre-push checks: 302 passed, 2 deselected

Review passes

• post-slice plan review: no implementation-vs-plan drift found
• cleanup pass: one safe-to-defer help-text drift item outside this slice
• ai-smell review: looks production-ready; only follow-up ideas deferred